=Loopop= Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== cf_iptables ===== 
<code bash>
vi /opt/myscripts/cf_iptables.sh
</code>
<code bash>
#!/bin/sh

# Define the interface as a variable
INTERFACE="ens3"

iptables -A INPUT -j DOCKER-USER
ip6tables -A INPUT -j DOCKER-USER

# Avoid racking up billing/attacks
# WARNING: If you get attacked and CloudFlare drops you, your site(s) will be unreachable.
iptables -I DOCKER-USER -i "$INTERFACE" -p tcp -m multiport --dports http,https -j DROP
ip6tables -I DOCKER-USER -i "$INTERFACE" -p tcp -m multiport --dports http,https -j DROP

# Source:
# https://www.cloudflare.com/ips
# https://support.cloudflare.com/hc/en-us/articles/200169166-How-do-I-whitelist-CloudFlare-s-IP-addresses-in-iptables-

for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I DOCKER-USER -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done
for i in `curl https://www.cloudflare.com/ips-v6`; do ip6tables -I DOCKER-USER -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done

# Avoid racking up billing/attacks
# WARNING: If you get attacked and CloudFlare drops you, your site(s) will be unreachable.
#iptables -A DOCKER-USER -p tcp -m multiport --dports http,https -j DROP
#ip6tables -A DOCKER-USER -p tcp -m multiport --dports http,https -j DROP

# WARNING: This does NOT block Cloudflare's clients from accessing your website over HTTP or HTTPS with a Cloudflare Worker.
</code>
<code bash>
chmod +x /opt/myscripts/cf_iptables.sh
</code>
<code bash>
vi /etc/systemd/system/docker-iptables.service
</code>
<code bash>
[Unit]
Description=Apply iptables rule to DOCKER-USER chain after Docker starts
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
ExecStart=/opt/myscripts/cf_iptables.sh

[Install]
WantedBy=multi-user.target
</code>
<code bash>
systemctl daemon-reload
systemctl enable docker-iptables.service
systemctl start docker-iptables.service
</code>